To guarantee the competitive edge of the 3GPP (3rd Generation Partnership Project) in the future, the work on evolved access technology is in progress within the 3GPP organization. Especially to strengthen the capability of 3GPP system for processing rapidly increasing IP data service, packet technology employed in the 3GPP system requires further improvement. Some most important parts of such evolved technology include: decreased delay and reaction time, accelerated user data rate, enhanced system capacity and coverage, and reduced overall cost of the operators. Moreover, the evolved network structure is also an important indicator for the backward compatibility of the existing network. In terms of the security therein, the user security procedure in the evolved network is required to guarantee that a security mechanism is provided which at least has a same level as that of the current 2G and 3G system.
As shown in FIG. 1, the core network of the wireless evolved network mainly includes logic function entities such as a Mobility Management Entity (MME), a System Architecture Evolution Gateway (SAE Gateway), and so forth. The MME is responsible for mobility management of control plane including managing the user context and mobility state, allocating temporary user identification, security function, etc. The SAE Gateway is responsible for paging downlink data in an idle state, managing and storing IP bearer context and routing information in the network, etc., serving as an anchor point for user plane between different access systems. In the wireless evolved network, the security of the user plane is terminated at the access network, where a Base Station (BS) of the access network is referred to as an evolved NodeB (eNB). The security of the signaling plane is divided into two parts, namely Access Stratum signaling Radio Resource Control (RRC) and Non Access Stratum (NAS) signaling, terminated at the access network and the core network respectively. The key required to secure the signaling and the data is derived diversely from keys, i.e., CK, IK, generated during an Authentication and Key Agreement (AKA) procedure. The deriving relations are illustrated as FIG. 2.
Therein, KeNB-RRC-INI is a security key for the integrity of RRC signaling, KeNB-RRC-ENC is a security key for the encryption of RRC signaling, and KeNB-RRC-UP is a security key for the encryption of user plane data, whereas KNAS-ENC is a security key for the encryption of the NAS, and KNAS-INI is a security key for the integrity of NAS signaling.